The vulnerability is a use‑after‑free flaw in the WebRTC Signaling component of Firefox. When the bug is triggered, the browser may access memory that has already been freed, potentially allowing an attacker to execute arbitrary code or cause a crash. The flaw is a classic instance of the "Use After Free" weakness (CWE‑416) and can lead to significant compromises of confidentiality, integrity, or availability.

Mozilla Firefox browsers at versions prior to 159 are affected. The specific version fix begins with Firefox 159, so users running any earlier release are at risk.

Because the flaw can be triggered from malicious web content, the attack vector is likely remote through a web page. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but use‑after‑free bugs are known to be highly exploitable when properly triggered. The absence of publicly available exploitation tooling does not mitigate the inherent risk of the flaw, and the lack of a defined CVSS score suggests that the severity may be high based on the nature of the weakness.